mirror of
https://github.com/zeek/zeek.git
synced 2025-10-03 23:28:20 +00:00
2a79fe95ec
- AYIYA works. - AYIYA analyzed connections are still labelled wrong in conn.log (logged as syslog) - Some clean up for left over code. - Small refactoring to pass packets back from analyzers to core. - $uid is now optional in conn logs since ip-in-ip tunnel parent's won't have an actual connection.
53 lines
No EOL
1,012 B
Text
53 lines
No EOL
1,012 B
Text
module Tunnels;
|
|
|
|
export {
|
|
redef enum Log::ID += { LOG };
|
|
|
|
type Action: enum {
|
|
DISCOVER,
|
|
CLOSE,
|
|
};
|
|
|
|
type Info: record {
|
|
ts: time &log;
|
|
uid: string &log &optional;
|
|
id: conn_id &log;
|
|
action: Action &log;
|
|
tunnel_type: string &log;
|
|
user: string &log &optional;
|
|
};
|
|
|
|
global register: function(c: connection, tunnel_type: string);
|
|
|
|
global active: table[conn_id] of Tunnels::Info = table();
|
|
}
|
|
|
|
event bro_init() &priority=5
|
|
{
|
|
Log::create_stream(Tunnels::LOG, [$columns=Info]);
|
|
}
|
|
|
|
function register(c: connection, tunnel_type: string)
|
|
{
|
|
local tunnel: Info;
|
|
tunnel$ts = network_time();
|
|
tunnel$uid = c$uid;
|
|
tunnel$id = c$id;
|
|
tunnel$action = DISCOVER;
|
|
tunnel$tunnel_type = tunnel_type;
|
|
|
|
active[c$id] = tunnel;
|
|
Log::write(LOG, tunnel);
|
|
}
|
|
|
|
event connection_state_remove(c: connection) &priority=-5
|
|
{
|
|
if ( c$id in active )
|
|
{
|
|
local tunnel = active[c$id];
|
|
tunnel$action=CLOSE;
|
|
Log::write(LOG, tunnel);
|
|
|
|
delete active[c$id];
|
|
}
|
|
} |